Overview

overview

10

Static

static

3df5b9962f...e6.exe

windows7_x64

10

3df5b9962f...e6.exe

windows10-2004_x64

10

Analysis

  • max time kernel
    4294213s
  • max time network
    127s
  • platform
    windows7_x64
  • resource
    win7-20220310-en
  • submitted
    29-03-2022 23:07

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    3df5b9962ff9ccff2797236e073991cdf9a6b04dfaad28a908d5dcd17afa21e6.exe

  • Size

    539KB

  • MD5

    29977a4237c7d10a0f09adb24540609c

  • SHA1

    330e45a0e9b32bad06831963bd46579458a5ec8d

  • SHA256

    3df5b9962ff9ccff2797236e073991cdf9a6b04dfaad28a908d5dcd17afa21e6

  • SHA512

    cd2c9b99c96be0e364a055343440618641aafa2cfedc6eef287ebeba3f204c9cf1d043643bbdd316f6c5b3e29de75189b4731e01d7719823d63e3bc0e666e48e

Score
10/10
dharmapersistenceransomwarespywarestealer

Malware Config

Extracted

Path

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta

Ransom Note
YOUR FILES ARE ENCRYPTED Don't worry,you can return all your files! If you want to restore them, follow this link: email [email protected] YOUR ID If you have not been answered via the link within 12 hours,Tox - 1123AA3360A5AFB77D928C4CD99E9EF66EF28FCEEE1F840B93456FD9CE562B7F92204B0D8904 please download - https://tox.chat/download.html or http://pexdatax.com/ write to us by e-mail: [email protected] Attention! Do not rename encrypted files. Do not try to decrypt your data using third party software, it may cause permanent data loss. Decryption of your files with the help of third parties may cause increased price (they add their fee to our) or you can become a victim of a scam.
URLs

https://tox.chat/download.html

http://pexdatax.com/

Signatures

  • Dharma

    Dharma is a ransomware that uses security software installation to hide malicious activities.

    ransomwaredharma
  • Deletes shadow copies 2 TTPs

    Ransomware often targets backup files to inhibit system recovery.

    ransomware
  • Modifies extensions of user files 2 IoCs

    Ransomware generally changes the extension on encrypted files.

    ransomware
  • Drops startup file 5 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Adds Run key to start application 2 TTPs 3 IoCs
    persistence
  • Drops desktop.ini file(s) 64 IoCs
  • Drops file in System32 directory 2 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Interacts with shadow copies 2 TTPs 2 IoCs

    Shadow copies are often targeted by ransomware to inhibit system recovery.

    ransomware
  • Modifies Internet Explorer settings 1 TTPs 2 IoCs
    adwarespyware
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of WriteProcessMemory 28 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\3df5b9962ff9ccff2797236e073991cdf9a6b04dfaad28a908d5dcd17afa21e6.exe
    "C:\Users\Admin\AppData\Local\Temp\3df5b9962ff9ccff2797236e073991cdf9a6b04dfaad28a908d5dcd17afa21e6.exe"
    1⤵
    • Modifies extensions of user files
    • Drops startup file
    • Adds Run key to start application
    • Drops desktop.ini file(s)
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:1712
    • C:\Windows\system32\cmd.exe
      "C:\Windows\system32\cmd.exe"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:1588
      • C:\Windows\system32\mode.com
        mode con cp select=1251
        3⤵
          PID:1176
        • C:\Windows\system32\vssadmin.exe
          vssadmin delete shadows /all /quiet
          3⤵
          • Interacts with shadow copies
          PID:1688
      • C:\Windows\system32\cmd.exe
        "C:\Windows\system32\cmd.exe"
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:1836
        • C:\Windows\system32\mode.com
          mode con cp select=1251
          3⤵
            PID:1344
          • C:\Windows\system32\vssadmin.exe
            vssadmin delete shadows /all /quiet
            3⤵
            • Interacts with shadow copies
            PID:2020
        • C:\Windows\System32\mshta.exe
          "C:\Windows\System32\mshta.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta"
          2⤵
          • Modifies Internet Explorer settings
          PID:1348
        • C:\Windows\System32\mshta.exe
          "C:\Windows\System32\mshta.exe" "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta"
          2⤵
          • Modifies Internet Explorer settings
          PID:1768
      • C:\Windows\system32\vssvc.exe
        C:\Windows\system32\vssvc.exe
        1⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:856

      Network

      MITRE ATT&CK Enterprise v6

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta
        Filesize

        7KB

        MD5

        d5fcf4b7a81e3e94d38aa94dff7a703c

        SHA1

        a2f4785aab0618d79cafb4c1f3786624bd497038

        SHA256

        60a94a86ed528810abf21cd463115f3ee91744e9a0cd1c84cdd50a896033a2bf

        SHA512

        1f06c4658e361bb9f0218e2384b60fbbf9587ac5169b80d9f0017658c46f3f85af090d9ab8274bb57e73fb72be82b2ac8b7b7a0400ef3c99cd73297115469f06

        Download Submit

      • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta
        Filesize

        7KB

        MD5

        d5fcf4b7a81e3e94d38aa94dff7a703c

        SHA1

        a2f4785aab0618d79cafb4c1f3786624bd497038

        SHA256

        60a94a86ed528810abf21cd463115f3ee91744e9a0cd1c84cdd50a896033a2bf

        SHA512

        1f06c4658e361bb9f0218e2384b60fbbf9587ac5169b80d9f0017658c46f3f85af090d9ab8274bb57e73fb72be82b2ac8b7b7a0400ef3c99cd73297115469f06

        Download Submit

      • memory/1176-58-0x0000000000000000-mapping.dmp

        Download

      • memory/1344-61-0x0000000000000000-mapping.dmp

        Download

      • memory/1348-63-0x0000000000000000-mapping.dmp

        Download

      • memory/1588-56-0x0000000000000000-mapping.dmp

        Download

      • memory/1688-59-0x0000000000000000-mapping.dmp

        Download

      • memory/1712-57-0x0000000002500000-0x0000000002A90000-memory.dmp

        Filesize

        5.6MB

        Download

      • memory/1712-54-0x0000000076361000-0x0000000076363000-memory.dmp

        Filesize

        8KB

        Download

      • memory/1712-55-0x0000000000400000-0x000000000048D000-memory.dmp

        Filesize

        564KB

        Download

      • memory/1768-64-0x0000000000000000-mapping.dmp

        Download

      • memory/1836-60-0x0000000000000000-mapping.dmp

        Download

      • memory/2020-62-0x0000000000000000-mapping.dmp

        Download